TOTOLINK A3300R CVE-2025-12240

Exploitation requires network access to the router's web management interface (/cgi-bin/cstecgi.cgi) and an authenticated low-privilege session (CVSS PR:L), so the attacker must possess valid or default credentials, or chain this with an authentication bypass. The specific trigger is the setDmzCfg function processing an attacker-controlled 'ip' argument that overflows a fixed buffer; the DMZ configuration feature path must be reachable. Limiting factors: the PR:L authentication requirement, the fact that it affects only the specific A3300R firmware build 17.0.0cu.557_B20221024, and the consumer/SOHO deployment profile (interfaces are typically LAN-facing unless remote management is enabled). No user interaction is required (UI:N).

This is a stack/heap buffer overflow (CWE-119) in the setDmzCfg handler of the cstecgi.cgi binary on the TOTOLINK A3300R router, reachable over the network. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates network reachability with low complexity but requires low-level privileges (PR:L), meaning an authenticated session is needed - exploitation is NOT fully unauthenticated despite being remote. Impact is high across confidentiality, integrity and availability (VC:H/VI:H/VA:H), consistent with arbitrary code execution or device crash on an embedded device. Publicly available exploit code exists (POC on GitHub), but there is no CISA KEV listing and the EPSS score is low (0.84%, 56th percentile), indicating no evidence of widespread automated exploitation at this time. Overall this is a genuine code-execution flaw on the device, but the PR:L authentication requirement and the niche consumer-router footprint temper its real-world priority: it is most relevant where attackers already have valid (or default) credentials or can chain it after an authentication bypass. Note the input provides only a CVSS 4.0 vector (base metrics with E:P); no CVSS 3.1 vector and no SSVC decision data were supplied, so automatable/exploitation-maturity beyond 'Proof-of-Concept' (E:P) cannot be independently confirmed.

An attacker with a valid or default low-privilege login to the A3300R web interface sends a crafted request to /cgi-bin/cstecgi.cgi invoking setDmzCfg with an oversized or malformed 'ip' argument, overflowing a buffer and corrupting memory. This can crash the device or lead to arbitrary code execution on the router. Public proof-of-concept exploit code for this exact function is already published on GitHub.